Essentials for cloud
PRO-09 Content filtering
Control what flows in and out of your cloud services. Block outgoing connections to known malicious or untrusted destinations. Inspect outgoing traffic for sensitive data leaving without authority, and inspect incoming content so malicious or unsafe material is not delivered.
Reviewed 18 October 2026 · Current to ASD's Essentials for cloud, published 15 October 2026
The principle
Data communicated between different security domains for systems (infrastructure and applications) is controlled and subject to inspection and verification.
The three actions
ASD's actions are quoted as published in Essentials for cloud. ASD has not given them IDs, so they are numbered by position. The letters show who does the work for each service model; our cloud guide explains them.
- C: Customer
- S: Supplied
- P: Provider-inherited
Action 1 of 3
Block outbound network connections to known malicious or untrusted destinations.
In plain English: Block outgoing network connections to destinations known to be malicious or untrusted.
- Domains
- Boundary services
- Critical processes and services
- Privileged environments
- Business systems
- User devices
- Who does it
- PaaSSupplied
- SaaSProvider-inherited
- MITRE ATT&CK
- Exfiltration Over C2 Channel
- Exfiltration Over Alternative Protocol
- Proxy
- Exfiltration Over Web Service
- Application Layer Protocol
Action 2 of 3
Inspect and control outbound flows from cloud services to detect unauthorised transfer of sensitive or high-value data.
In plain English: Inspect and control traffic leaving your cloud services. Look for sensitive or high-value data being sent out without authority.
- Domains
- Identity services
- Critical processes and services
- Privileged environments
- Business systems
- User devices
- MITRE ATT&CK
- Exfiltration Over C2 Channel
- Exfiltration Over Alternative Protocol
- Proxy
Action 3 of 3
Inspect inbound content from external or untrusted sources to prevent delivery of malicious or unsafe content.
In plain English: Inspect content that comes from outside or untrusted sources. Stop malicious or unsafe content from being delivered.
- Domains
- Boundary services
- Critical processes and services
- Business systems
- Who does it
- PaaSSupplied
- SaaSProvider-inherited
- MITRE ATT&CK
- Phishing
- Ingress Tool Transfer
- User Execution
See all 30 principles in Essentials for cloud, or read our cloud guide.
Sources
The ASD publications this page quotes.
Quoted ASD material © Commonwealth of Australia 2026, licensed under CC BY 4.0.
MITRE ATT&CK® technique names and IDs: © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. See MITRE's ATT&CK terms of use.
Everything else on this page is written by Control Stack.